Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to…Check if you run itEPSS 0.24%Oct 16, 2026
- High8.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the parameter of the…Check if you run itEPSS 1.47%Oct 16, 2026
- Medium4.3The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in…Check if you run itEPSS 0.20%Oct 16, 2026
- Medium4.9Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection…Check if you run itEPSS 0.23%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which all…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium4.9The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and inclu…Check if you run itEPSS 0.29%Oct 16, 2026
- High7.2The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and includ…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium6.4The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to,…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium5.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removi…Check if you run itEPSS 0.29%Oct 16, 2026
- Low2.7The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter.Check if you run itEPSS 0.32%Oct 16, 2026
- Medium6.4The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in a…Check if you run itEPSS 0.26%Oct 16, 2026
- High7.2The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (e.g.Check if you run itEPSS 0.36%Oct 16, 2026
- Medium6.8The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to th…Check if you run itEPSS 0.46%Oct 16, 2026
- Medium5.3The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4…Check if you run itEPSS 0.35%Oct 16, 2026
- Medium4.8The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The…Check if you run itEPSS 0.31%Oct 16, 2026
- High7.8A flaw was found in cifs-utils.Check if you run itEPSS 0.15%Oct 16, 2026
- High8.8The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.Check if you run itEPSS 0.37%Oct 16, 2026
- High7.2The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and…Check if you run itEPSS 0.20%Oct 16, 2026
- High7.2The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is…Check if you run itEPSS 0.24%Oct 16, 2026
- High8.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versio…Check if you run itEPSS 0.34%Oct 16, 2026
- High7.2The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[ ]' parame…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium5.4The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin…Check if you run itEPSS 0.23%Oct 16, 2026
- High7.2The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' param…Check if you run itEPSS 0.20%Oct 16, 2026